Vendor due diligence in Chile: what the law requires and how to tier the review by risk

That rule is in Article 3 of Law 20.393, which makes the company criminally liable for a listed crime perpetrated within its activity by or with the intervention of a natural person who holds a position, function or post in it, or who provides it services managing its affairs before third parties, with or without its representation. Liability also requires that the lack of effective implementation of an adequate prevention model favored or facilitated the act. The second paragraph extends the rule to an act perpetrated through a natural person linked to a different legal entity, when that entity provides it services managing its affairs before third parties or lacks operational autonomy with respect to it, "cuando entre ellas existan relaciones de propiedad o participación" (where there are ownership or participation relations between them). The law does not clarify whether this last requirement applies to both hypotheses or only to the lack of autonomy. The third paragraph excludes an act perpetrated exclusively against the legal entity itself, such as a vendor's fraud that harms only the company.

Article 4 then describes when the model is adequate to exempt the company from criminal liability, to the extent required by its corporate purpose, line of business, size, complexity, resources and activities: the identification of the activities or processes that carry criminal risk (No. 1); protocols to prevent and detect those conducts, which must necessarily consider secure reporting channels and internal sanctions (No. 2); one or more persons in charge with independence, powers and resources, the encargado de prevención de delitos (the crime prevention officer) (No. 3), and periodic evaluations by independent third parties (No. 4). No. 2 adds the sentence that takes the model into the contract with the vendor: the internal rules must be expressly incorporated into the employment and service contracts of all workers, employees and service providers, including top executives. It is a condition for the model to serve as an exemption, and it reaches every service provider. The law does not require reviewing the vendor; the review is the way to identify which of those contracts concentrate the risk of No. 1.

The practical consequence is to distinguish vendors by what they do for the company. A supplier of goods with no access to authorities, clients or company systems generates little attributable risk. An agent, a permit manager or a debt collector who acts before third parties on the company's behalf is the person described in the first paragraph of Article 3; a group entity that does the same or lacks operational autonomy, the one in the second paragraph. If the vendor is an external company with no ownership link, such as a customs agency or a collection company, the scope of Article 3 is debatable: it depends on whether the natural person acting for that company provides services to yours in the terms of the first paragraph and on how the ownership or participation requirement of the second paragraph is read. A distributor that buys and resells on its own account normally does not manage the company's affairs, unless it does so before authorities or clients, with or without its representation. In case of doubt, the risk justifies treating them at the highest level. The prevention model is explained in the crime prevention model and the liability regime in Law 20.393.

That change has a date: Law 21.719 incorporates into Law 19.628 the rules that follow from December 1, 2026. A Government bill before the Senate (Bulletin 18.623-07) proposes to postpone that date to December 1, 2027. Until then, Article 8 of Law 19.628 governs: processing under a mandate is subject to the general rules, the mandate must be granted in writing, with express record of the conditions for using the data, and the mandatario must respect them. A contract signed today that remains in force in 2026 or 2027 is best drafted now with the content of the new Article 15 bis.

Under Article 15 bis, the controller (responsable) may process data directly or through a third-party mandatario or encargado, which processes only according to the assignment and the controller's instructions and may not use the data for a different purpose or transfer them without express and specific authorization. If the processor does either, it will be considered a controller for all legal purposes: it will answer personally for infringements and jointly and severally with the controller for damages. The contract will have to set out the object of the assignment, its duration, the purpose of the processing, the type of personal data, the categories of data subjects and the rights and obligations of the parties. Subcontracting will require specific written authorization, and a processor that delegates will remain jointly and severally liable. The processor will be subject to the duties of secrecy (Article 14 bis) and security (Article 14 quinquies), will have to inform the controller of security breaches and, once the service ends, delete or return the data.

Two rules of the reform matter for procurement. Article 1 bis will apply the law to a mandatario that processes data on behalf of a controller established in Chile, wherever it is incorporated; so a foreign cloud or payroll vendor will fall within the regime. And Article 14 septies will allow the Agencia de Protección de Datos Personales (the data protection agency) to set, by general instruction, differentiated security standards by type of data, company size and activity, applicable to the processor as well. For vendors that take data abroad, the transfer rules are in international data transfers and the general regime in the Data Protection Law.

In Law 21.663, Article 7 requires the bound institutions to apply on a permanent basis technological, organizational, physical or informational measures "para prevenir, reportar y resolver incidentes de ciberseguridad" (to prevent, report and resolve cybersecurity incidents), implementing the protocols and standards of the Agencia Nacional de Ciberseguridad (the national cybersecurity agency) and the standards of their sectoral regulation. Article 9 requires all the institutions of Article 4 to report to the National CSIRT the incidents that may have significant effects: early warning within three hours, update within 72 hours (24 hours for an operator of vital importance whose essential services are affected) and final report within 15 calendar days. Article 8 adds, for operators of vital importance (operadores de importancia vital), a continuous information security management system that determines the risks for networks, systems, data and operational continuity, certified continuity plans reviewed at least every two years, exercises and drills, training programs for workers and collaborators, and a cybersecurity delegate. The same Article 8 governs the infrastructures, processes or functions the Agency identifies as essential (Article 4, final paragraph). Articles 7 and 8 do not name the vendor. The only explicit mention is in Article 9 and applies to State bodies: their heads of service must require information technology vendors to share information on vulnerabilities and incidents, and contracts may not restrict that communication.

For a bound private institution, the conclusion is the same as under the other two laws. Neither the permanent measures of Article 7 nor, where applicable, the management system of Article 8 letter a) can cover the risks of its networks without covering the vendors that operate or access them. The three-hour deadline of Article 9 is not met either if the vendor operating the systems does not give timely notice. The contract is the instrument that turns that analysis into obligations. Article 4 adds a point to check at the outset: digital services and managed information technology services provided by private institutions are, by law, essential services. The law does not define those two categories, so their exact scope will depend on how the Agency interprets them. But a vendor that fits them is a bound institution in its own right. Articles 7 and 9 apply to it, with measures the Agency must differentiate by type of organization, with special consideration for small and medium-sized enterprises (Article 7, fourth paragraph). Article 8 as well, if the Agency classifies it as an operator of vital importance or identifies its infrastructures, processes or functions as essential (Article 4, final paragraph). To find out whether your company is subject to the law, see the Cybersecurity Framework Law.

The level is assigned to each relationship: the same company may sit at two levels under two different contracts. The document that matters is the one recording why a vendor ended up where it did. Article 4 asks the model to seriously and reasonably consider the aspects it lists, the first of them the identification of the processes with risk, and a reasoned tiering is evidence that that consideration took place. The review is repeated on a change in the relationship, a change in the vendor's ownership, an incident or the periodic evaluation of the model.

• Incorporation of its internal rules: the protocols and internal sanctions of the prevention model become part of the service contract, as Article 4 No. 2 of Law 20.393 requires for the model to be adequate. It applies to every service provider.
• Reporting channel and cooperation: the vendor knows the secure reporting channel of Article 4 No. 2 and undertakes to cooperate in internal investigations.
• Data processing clauses: today, the written mandate with the conditions for using the data required by Article 8 of Law 19.628; from the entry into force of Law 21.719, the content of Article 15 bis: object, duration, purpose, types of data, categories of data subjects, rights and obligations; subcontracting only with specific written authorization; notice of breaches to the controller; deletion or return at the end.
• Incident notice: a vendor that operates or accesses networks and systems of an institution subject to Law 21.663 undertakes to notify it immediately of any cybersecurity incident and to provide the information it needs to report to the National CSIRT within the deadlines of Article 9: early warning within three hours, update within 72 hours (24 for an operator of vital importance whose essential services are affected) and final report within 15 calendar days.
• Security obligations proportionate to the level, consistent with Article 14 quinquies of Law 19.628 once in force and, for bound institutions, with the protocols and standards of the Agencia Nacional de Ciberseguridad (Article 7 of Law 21.663).
• Audit and inspection rights, with the vendor's duty to produce evidence on request.
• Termination for breach of any of the above, without compensation, and survival of the duties of confidentiality and return of data.

Vendor review is an ongoing compliance process; on the criminal side, the prevention officer leads it. The review of a company being acquired is a one-off exercise, with its own method, covered in legal due diligence. The tiering of vendors feeds the risk map of the prevention model and, in institutions bound by Law 21.663, the risk management of the Cybersecurity Framework Law; contracts with processors become part of the data protection compliance documentation. That way, each vendor has a single file for all three laws.